[TOOL]FIDO Conformance Tools v1.7.0

[Daniel Tsai]

HI,

We use the conformance tool v1.5.2 is okay. But Change to v1.7.0 get below errors. We don't know how to solve it. Can you give some suggestions to solve this?

Server-ServerAuthenticatorAttestationResponse-Resp-5 Test server processing "packed" FULL attestation 

F-10 Send ServerAuthenticatorAttestationResponse with FULL "packed" attestation, with attStmt.x5c containing full chain, and check that server returns an error

Error: the string "Promise succeded when expected to fail!" was thrown, throw an Error :)

Server-ServerAuthenticatorAttestationResponse-Resp-6 Test server processing "packed" SELF(SURROGATE) attestation

F-2 Send ServerAuthenticatorAttestationResponse with SELF "packed" attestation, that contains full attestation, and check that server returns an error

Error: the string "Promise succeded when expected to fail!" was thrown, throw an Error :)

--

============================
Daniel Tsai (蔡沛勳)
TEL: 0922021468
E-Mail: pst....@gmail.com
============================

[Shane Weeden]

Personally I don’t agree with the rules of the first test case. See https://github.com/fido-alliance/conformance-test-tools-resources/issues/678

Sent from my iPhone

On 9 Aug 2022, at 3:17 pm, Daniel Tsai <pst....@gmail.com> wrote:



--
You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fido-dev+u...@fidoalliance.org.
To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/CAOnab%3DKWDZkbTpqhRMCQNmQCt2xZq-geW%3DYHjYUwFiLHr_FzvA%40mail.gmail.com.

[Philipp Junghannß]

sounds to me like that usually you only get one attestation cert rather than a full chain, and they expect you to error out when you get a full chain.

To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/030A4441-7BB0-4437-BE02-E3618549F493%40gmail.com.

[Ackermann Yuriy]

These two tests were in the conformance tools since day one.

First test checks that you follow RFC5280 and avoid duplicate certificates.

Second check that if you have an authenticator that advertises support only for SELF(SURROGATE) attestation, and it suddenly returns FULL, that obviously won't work.

Don't forget to update your metadata.

Thanks.

Yuriy

Yuriy Ackermann

FIDO, Identity, Standards

skype: ackermann.yuriy

github: @herrjemand

twitter: @herrjemand

medium: @herrjemand

--

[Daniel Tsai]

HI  Yuriy,

Thanks for your reply. How could I to update the metadata? Is it from conformance tool or not?  and How to implement it to server side?

regards,

Daniel

Ackermann Yuriy 在 2022年8月9日 星期二下午2:33:47 [UTC+8] 的信中寫道：

[Ackermann Yuriy]

“Download Metadata” button.

Additionally be aware that tools moved to new MDS3 metadata format.

https://medium.com/webauthnworks/webauthn-fido2-whats-new-in-mds3-migrating-from-mds2-to-mds3-a271d82cb774

--